4 ms·

IANAL but the difference seems to be gigantic. If the secret key is stored on a company server, then that company can be subpoenaed for it. If it's not on the c

IANAL but the difference seems to be gigantic. If the secret key is stored on a company server, then that company can be subpoenaed for it. If it's not on the company's server, the client's endpoint has to be compromised (e.g. by a police raid or by electronic surveillance). The former is much easier than the latter. I don't think government authorities can force companies to actively eavesdrop on their clients by pushing malware through their update mechanism to a client's device, at least not officially in non-authoritarian countries with due process.

Ray20 1y ago
>If it's not on the company's server If. Just recently there was a news about how meta bruteforcing localhost of all its users to hack their devices (https://localmess.github.io/ https://localmess.github.io/). And now someone seriously suggests to believe that meta does not collect private keys on its servers? Moreover, I think that now corporations don't even have an option not to steal keys from users: you either have their keys or go to jail. And if you have the keys, but users think you don't and trust all their secrets - that's even better. And if you think government authorities can't do something, look what happened to Alexey Pertsev. A criminal uses your tool to ensure their privacy? You're going to jail. So in today's world, it's better to have keys on your server, even if you're not going to use them. Because at some point, you might be asked for them and refusing (ore not having one) will mean jail time.
IshKebab 1y ago
> I don't think government authorities can force companies to actively eavesdrop on their clients by pushing malware through their update mechanism to a client's device, at least not officially in non-authoritarian countries with due process. Yeah unfortunately that list no longer includes countries like the UK and Australia.

Ray20 1y ago

>If it's not on the company's server If. Just recently there was a news about how meta bruteforcing localhost of all its users to hack their devices (https://localmess.github.io/ https://localmess.github.io/). And now someone seriously suggests to believe that meta does not collect private keys on its servers? Moreover, I think that now corporations don't even have an option not to steal keys from users: you either have their keys or go to jail. And if you have the keys, but users think you don't and trust all their secrets - that's even better. And if you think government authorities can't do something, look what happened to Alexey Pertsev. A criminal uses your tool to ensure their privacy? You're going to jail. So in today's world, it's better to have keys on your server, even if you're not going to use them. Because at some point, you might be asked for them and refusing (ore not having one) will mean jail time.

IshKebab 1y ago

> I don't think government authorities can force companies to actively eavesdrop on their clients by pushing malware through their update mechanism to a client's device, at least not officially in non-authoritarian countries with due process. Yeah unfortunately that list no longer includes countries like the UK and Australia.